Is CVE-2025-39964 (Linux Kernel Race Condition) being exploited in the wild?

Yes. CISA added CVE-2025-39964 to its Known Exploited Vulnerabilities catalogue on 18 September 2026, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket’s internal state.

What “exploited in the wild” means for this Linux kernel CVE

CISA’s KEV listing is the practical threshold here. Once a CVE appears in that catalogue, defenders should treat it as actively exploited, not merely theoretically dangerous, and prioritise exposure review on any Linux estate that could run the vulnerable kernel path. For the authoritative record, compare the CVE entry at the CVE Program and the CISA Known Exploited Vulnerabilities Catalog.

A race condition in the kernel is different from a simple crash bug: exploitation depends on timing, concurrency and the attacker’s ability to trigger the unsafe path repeatedly until state becomes inconsistent. That makes confirmation harder than with a one-shot memory corruption issue, so the operational question is not just whether a patch exists, but whether any exposed systems have already been touched or destabilised.

Why the AF_ALG race condition matters operationally

The flaw affects kernel behaviour at a low level, so the main concern is shared-state corruption rather than a visible application error. If concurrent writes can interleave unpredictably, the resulting inconsistency can undermine integrity, stability and, in some environments, create a stepping stone for privilege or isolation failure. For Linux fleet owners, the issue is not limited to one package version tree; it is about whether the affected kernel behaviour is present anywhere in the estate.

This is the kind of vulnerability where exploitation can be subtle. A host may continue running while internal state is already corrupted, which means logs and alerts may lag behind the real compromise window. When a flaw reaches KEV status, the practical assumption should shift from “can this be exploited?” to “which hosts might already have exploitable exposure, and which services depend on them?”

How to verify exposure and decide what to do next

Start by identifying every system running a kernel build that could contain the affected code path, including production servers, containers with host kernel dependencies and managed appliances that inherit the host kernel. Then confirm whether the vendor has supplied a fixed build or a mitigation path, using the vendor advisory and KEV record rather than secondary summaries for version decisions.

If patching must wait, reduce attack surface by limiting who can reach the host, tightening monitoring around anomalous kernel or service behaviour, and treating any unexplained instability as a potential compromise indicator. The NIST Cybersecurity Framework 2.0 is useful here because it pushes the response toward identify, protect, detect, respond and recover rather than leaving the issue as a one-time patch task.

Risk and Threat Considerations

KEV inclusion means the exposure is no longer hypothetical. For kernel race conditions, the risk is not only exploitation itself, but also the difficulty of seeing the abuse before state corruption or service instability spreads across dependent workloads.

Failure mechanism: An attacker or faulty workload can repeatedly trigger the unsafe concurrent-write path until kernel state becomes inconsistent, producing unpredictable behaviour that may conceal compromise or destabilise the host.

Impact: The likely consequence is host integrity loss, service disruption or a broader foothold on systems that rely on the same kernel trust boundary.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Tracks KEV-status vulns and drives prompt remediation of exposed systems.
Recommendation — Prioritise and verify remediation for KEV-listed kernel vulnerabilities across the Linux fleet.
NIST CSF 2.0	GV.RM-01 — Risk Management Strategy	Active exploitation changes prioritisation and exception handling for exposed assets.
	DE.CM-01 — Networks and network services are monitored to find potential cybersecurity events	Kernel exploitation may present as subtle instability, so monitoring is part of validation.
Recommendation — Escalate KEV-listed exposure into formal risk decisions and remediation priorities. Monitor Linux hosts for abnormal kernel or service behaviour consistent with exploitation.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	Requires prompt correction of identified kernel flaws and validation of mitigation.
	SI-4 — System Monitoring	Detection of exploitation or instability depends on host and service monitoring.
Recommendation — Apply approved kernel fixes or mitigations and confirm the vulnerable code path is removed. Increase monitoring for symptoms and alerts that indicate exploitation or state corruption.

Practitioner Guidance

What to verify: Confirm whether each Linux asset is still running an affected kernel branch, then validate whether the vendor fix or mitigation has actually been applied, not just scheduled. For KEV items, patch status on paper is not enough; you need evidence that the vulnerable path is no longer present.

What to prioritise: Treat internet-facing systems, privileged infrastructure, and hosts with shared tenancy or high blast radius as first-wave candidates for remediation. If the kernel underpins multiple services, one delayed fix can preserve exposure across several business functions.

Practitioner takeaway: When a kernel CVE enters KEV, the right response is exposure elimination plus compromise checking, not patch-and-forget. Assume active exploitation is plausible until the affected kernel is removed or mitigated and the host is checked for signs of tampering.